For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

A recent digital spying operation targeted at the Tibetan community once again revealed just how little it takes for attackers to mount an effective malicious campaign these days.

Researchers at the University of Toronto's Citizen Lab were able to gain an inside view of the phishing campaign by taking advantage of some sloppy mistakes by the operator.

Over a period of eight months the researchers observed the operator setting up phishing lures, building fake Web pages, registering dozens of decoy domains, and sending emails to targeted individuals and organizations within the Tibetan community.

They estimated that during the 19 months when the operation was active, the attackers likely spent a mere $1,068 on infrastructure costs: $878 for domain registration and $190 for renting servers. Citizen Lab's researchers found that it took just basic Web development and system admin skills to run the operation, which though sloppy, was still surprisingly successful.

The attackers managed to compromise the email accounts of at least two of their intended targets and used their contact lists to send phishing lures to other targets. "We suspect there were likely other successful compromises beyond these accounts based on decoy documents we collected that appear to be private files likely extracted from compromised accounts," Citizen Lab's director Ronald Deibert said in a blog Tuesday.

According to Deibert, Citizen Lab was unable to find any evidence directly linking the operation to a specific criminal group or nation-state sponsor. But the group's targeting strongly suggests a China link: besides Tibetan activists, the operators also appeared to be interested in people from within China's Uyghur minority community, as well as a media group founded by members of the Falun Gong religious group, and other groups in Hong Kong and Burma.

It is possible the group behind the phishing campaign were freelancers or independent contractors working on behalf of a government agency in China. The sloppiness of the campaign suggests the threat actors were operating with little fear of getting caught. "The profile of the operator suggests it may be a low-level contractor," says Masashi Nishihata, research manager at Citizen Lab. "It is unclear how the operators selected targets. Nor is it clear if the operators had a specific sponsor and who was the ultimate consumer of data collected."

Citizen Lab's research showed how in addition to conducting malicious campaigns on the cheap, threat actors also often will use only what is necessary to meet their objectives. Few will ever resort to using sophisticated costly tools and attack methods if they can break into a target system using inexpensive, basic techniques. "This case shows that it doesn't take deep pockets or sophisticated technical skills to mount an effective digital spying operation. While the operation was done on the cheap, it had some successes," Nishihata says.

On a Low Budget

The Citizen Lab findings are similar to other reports that also have shown the enormous returns that criminals and cyber spies can garner from relatively meager investments. Last November, a Recorded Future report dissecting the costs of cybercrime operations found that an individual or group willing to spend between $3,500 and $5,000 on a botnet operation could easily net between 400% and 600% in direct and indirect returns.

Just like Citizen Lab discovered with the Tibetan phishing campaign, Recorded Future's researchers found that threat actors often require little technical skills to carry out lucrative campaigns. So many tools and services are available - and in such a wide price range - on the Dark Web that anyone from a newbie to a sophisticated nation-state actor can find something for their needs, Recorded Future found.

A Trend Micro report last October found that in some underground cyber markets — like those catering to the Middle East and North African threat community — there is almost no bar for entry for malicious actors. Many common attack tools, including those used for SQL injection, keystroke logging, and malware obfuscation, are available for free to members on these networks.

This trend highlights the need for organizations to pay attention to the basics, experts say. Contrary to perception, adversaries often apply low-level tools and tactics to carry out attacks so basic practices such as timely patching and strong authentication can help mitigate them as well.

The Tibetan phishing campaign is one example. "Addressing this problem requires raising the low bar and making digital spying more expensive for adversaries," Nishihata says. "Much of the threat posed by the basic phishing techniques used in this operation could be blunted through use of security features like two-factor authentication."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.

Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\server.xml) that could potentially be exploited by malicious users to compromise the affected system.

In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.

The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requ...